win:sysmon 26
FileDeleteDetected (File Delete logged)
A file was deleted.
- Log source
- Sysmon
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Install Sysmon with a configuration that includes the matching rule group; see sysmon-modular for an ATT&CK-mapped configuration.
- Tier, host type
- Listed
- Techniques
- 0
- Rules depending on it
- Splunk 9
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Listed | |
| Windows member server | Listed | |
| Windows domain controller | Listed | |
| Windows web server (IIS), internet-facing | Listed |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
Splunk 9
- Excessive File Deletion In WinDefender Folder
- Windows ConsoleHost History File Deletion
- Windows Data Destruction Recursive Exec Files Deletion
- Windows Default Rdp File Deletion
- Windows High File Deletion Frequency
- Windows MSI Rollback Script Deleted By Non-Msiexec Process
- Windows Mark Of The Web Bypass
- Windows RDP Cache File Deletion
- Windows Rdp AutomaticDestinations Deletion
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Object and data eventsAppendix B item 5(3) | Supports an activity | our analysis: file delete logged |